Priorize a correção. Ela está sob exploração confirmada pelo CISA.
ssvc Actcvss 9.3
da publicação à arma
Publicada no NVD22 de set.
CISA KEV22 de set.
probabilidade de exploração
—
exploração observada
simCISA + VulnCheck
Ação exigida pela CISAprazo federal: 2026-09-25
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Em resumo
Uma falha na configuração do OAuth no F5 BIG-IP APM permite que invasores executem código malicioso remotamente sem necessidade de autenticação, comprometendo o sistema.
Detalhe técnico
Quando políticas de acesso do BIG-IP APM e perfis OAuth estão habilitados em um servidor virtual, atacantes não autenticados podem enviar tráfego malformado específico para alcançar execução remota de código no plano de dados.
Resumo gerado e traduzido por IA a partir da descrição oficial.
When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can lead to remote code execution (RCE). This vulnerability is only present when BIG-IP APM is configured as an OAuth Authorization Server. Deployments using APM strictly as an OAuth Client / Resource Server (without OAuth authorization server profiles configured) are not affected by this vulnerability.
Impact:
This vulnerability allows an unauthenticated attacker to perform remote code execution. The BIG-IP system in Appliance mode is also vulnerable. This is a data plane issue; there is no control plane exposure.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.